From 84e860e403e566a19bb0b9206fd93a00747c931e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=90=9D=E5=8D=9C?= <dev@saasshop.local>
Date: Sat, 14 Mar 2026 21:17:02 +0000
Subject: [PATCH] fix(backurl): avoid duplicating back query when already
 present

---
 app/Support/BackUrl.php                       |  5 ++++
 tests/Unit/BackUrlWithBackNoDuplicateTest.php | 27 +++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 tests/Unit/BackUrlWithBackNoDuplicateTest.php

diff --git a/app/Support/BackUrl.php b/app/Support/BackUrl.php
index f3219a6..2f20be3 100644
--- a/app/Support/BackUrl.php
+++ b/app/Support/BackUrl.php
@@ -114,6 +114,11 @@ class BackUrl
             return $base . '?' . $backQuery;
         }
 
+        // 若 path 自身已包含 back=（调用方误用），则不再追加，避免重复 back 造成 URL 膨胀/绕过。
+        if (preg_match('/(?:^|&)back=/', $qs)) {
+            return $base . '?' . $qs;
+        }
+
         if ($preferFirst) {
             return $base . '?' . $backQuery . '&' . $qs;
         }
diff --git a/tests/Unit/BackUrlWithBackNoDuplicateTest.php b/tests/Unit/BackUrlWithBackNoDuplicateTest.php
new file mode 100644
index 0000000..4bbe302
--- /dev/null
+++ b/tests/Unit/BackUrlWithBackNoDuplicateTest.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Support\BackUrl;
+use Illuminate\Support\Arr;
+use Tests\TestCase;
+
+class BackUrlWithBackNoDuplicateTest extends TestCase
+{
+    public function test_with_back_should_not_duplicate_when_path_already_has_back_query(): void
+    {
+        $back = '/admin/platform-orders/2';
+
+        $path = '/admin/site-subscriptions/2?' . Arr::query([
+            'back' => $back,
+            'order_sync_status' => 'syncable',
+        ]);
+
+        $url = BackUrl::withBack($path, $back);
+
+        $this->assertSame($path, $url);
+
+        // 防止重复 back= 出现两次
+        $this->assertSame(1, substr_count($url, 'back='));
+    }
+}